Since we perform relaxation and train the network which is also used to compute LPIPS, the exact layerwise coefficients \(\alpha _l\)  from the original LPIPS [1]} are no longer applicable and cannot be used to set the layerwise bounds \(\operatorname{\mathbf {\varepsilon }}_l\) . Therefore, we set our own values of \(\operatorname{\mathbf {\varepsilon }}_l\)  which we specify in App.  together with detailed derivations of RLAT, its precise algorithm and other implementation details.
Finally, we remark that related layerwise adversarial training methods have been proposed before [2]}, [3]}, [4]}.
However, viewing layerwise adversarial training as an efficient relaxation of LPIPS adversarial training is novel, as well as applying these methods for general robustness such as common corruptions.
